Privacy policy

The measures taken to protect your data are detailed in our security charter.

This English translation is provided for information only. The French version is the only legally binding one. Politique de confidentialité (version française)

Data controller

Sébastien Couchard, sole trader (entrepreneur individuel) operating under the name “Agence 213”, 1 chemin du Prieur, 89140 Michery, France. Contact: contact@opcard.fr.

Data collected

Order: last name, first name, job title, company, SIRET number, phone, email, links, logo and colours; for an individual card, the main use chosen before payment (business, job search, association, personal contact details or other), which is used to tailor the tips sent on delivery.
Dashboard and change requests: customer number, email, content of the card, description of the requested change.
Contact details left on a card: first name, last name, company, phone, email, message, answers to the questions the cardholder has chosen to add to their form and, if attached, a photo of the business card of the person who chooses to send them to the cardholder. They are passed on to that cardholder, who becomes responsible for them; for a card linked to a manager dashboard, the company is responsible for them. If the cardholder has enabled the follow-up email, the email address left is also used to send, once only and on behalf of the cardholder, the link to their card; the box ticked by the person states this.
Customer dashboard CRM: business contacts that the cardholder adds there themselves (name, company, job title, phone, email, website, notes). The cardholder is responsible for them, or their company if the card is linked to a manager dashboard; we host them on the cardholder’s behalf, without viewing or reusing them, and they are deleted with their dashboard. The cardholder of a card linked to a team can pass a contact on to a colleague in the same team: the contact then moves into that colleague’s CRM, and the colleague is notified by email. When the cardholder scans the QR code of another person’s virtual business card, our server consults the public page of that card to read the contact details it offers for saving; the QR code reader is loaded from the jsDelivr service and the camera image does not leave the phone. The photo of a paper card is read on the cardholder’s phone; it is then kept with the contact in their CRM, visible to them and, for a card linked to a manager dashboard, to the person designated by the company; it is deleted with that contact. Dictation, when used, goes through the speech recognition service of the phone or browser. The open-source reading software is downloaded from the jsDelivr service at the first scan, which discloses the device’s IP address to that service.
Manager dashboard: when a company brings together the cards of its team members, the person it designates receives a personal link to a dashboard which displays, read-only, the audience figures of these cards and the contacts in their CRMs (first name, last name, company, job title, phone, email, message, note, follow-up given), with the name of the team member, and which allows them to be downloaded. Photos of paper cards kept with these contacts also appear there. Each team member concerned is informed of this in their own dashboard.
Notifications: if the cardholder enables them in their dashboard, their phone gives us a delivery address specific to its notification service (Google for Android, Apple for iPhone). The content of each notification is sent encrypted. The cardholder can turn them off at any time.
Review requests: if the cardholder enables this feature, an email is sent once only, on their behalf, to the contact they have classified as “Client” and “Finalised” in their CRM, with the link to their Google reviews page. Any reply goes to the cardholder.
Referral networks: when the cardholder joins a network (network code and approval by an administrator), the other members see their card (name, job title, company, photo or logo) and their role in the network. When a member passes a contact from their CRM on to another member, with the consent of the person concerned, that contact (first name, last name, company, job title, phone, email, website) and the accompanying note are copied into the CRM of the receiving member, with the name of the member who passed it on. When a person opens a member’s card through a referral link, they see the name of the member who gave it to them, and the contact details they choose to leave reach the cardholder with that name. The network keeps the list of referrals (date, name of the contact, company, follow-up indicated). Nobody, administrators included, has access to other members’ CRMs.
Network feed: announcements, questions, replies and event attendance posted by a member are visible only to the members of the network, with their name and company; they are deleted one year after posting. The optional member profile (what they offer, what they are looking for, their town) is visible to the members of their networks. The weekly summary email can be turned off at any time from “My network”. If a network’s administrators enable it, each member’s public card displays “Member of the network” followed by the name of the network; each member can hide this mention on their card. When a member invites another with their personal code, the members see who brought them in.
“Venue” card (café, restaurant, shop…): a visitor can send the business up to 3 photos, with, if they wish, their first name, a note and their email. The photos are reduced in size and stripped of their hidden information (location, device) as soon as they are received; they are visible only to the business. The publication permission given by the visitor is recorded with its date. If the visitor ticks the box provided (never ticked in advance), when sending a photo or through the “Get notified of events” button, their email, and their name if they give it, join the business’s subscriber list to receive its news, with the date of their consent; Opcard sends them, on behalf of the business, announcements of its new events and its new menu; they can unsubscribe at any time using the link in each email. For these photos and this list, the business is the data controller; we host them on its behalf.
Referral programme: the referral code followed by the referred person is passed on with their order, in order to credit the customer who referred them.
Card audience measurement: a simple daily total of openings, contacts saved, taps on each button of the card and times the cardholder displays their “Save” QR code, without IP address, without identifier and without cookies. On the cardholder’s phone, the card opened through their personal link keeps a simple local marker so as not to count their own openings. We also record the days on which the cardholder opens their dashboard. We consult these totals, never the details of contacts, to monitor use of the service and to keep in touch with our customers.
Contact form: name, company, email, phone, message.
Payment: it is processed by our payment provider. We do not have access to bank card numbers.

Why we use this data

To create and keep your card up to date, to process your payment and issue your invoice (performance of the contract), to answer your questions (pre-contractual measures), and to comply with our accounting obligations (legal obligation).

A card is made to be shared

The information you choose to display on your card is visible to anyone who has its link or its QR code.

Google Calendar, if you connect it: your Google user data

In your dashboard, the “Connect my Google Calendar” button asks you for access to your Google Calendar (scope calendar.events.owned). Connecting it is optional: everything else works without it.

How we use your Google user data

The access is used for one thing only: to add to your primary Google Calendar the appointments you record in your CRM, to update them when you change them, and to remove them when you cancel them.
We only act on events that our application has created itself. We do not read, copy or analyse any other event, nor your contacts, nor your emails, nor any other data in your Google account.
What we send to Google: for each appointment, the date and time, the first name, last name and company of the contact and, in the description, their phone, email, message and your note.
What we receive from Google and keep: the long-term authorisation for the connection (refresh token), the identifier of each appointment we have added and the colour you have chosen. The temporary access token, valid for one hour, is only used while the appointment is being added.
This data is not sold, not passed on to third parties, not used for advertising, and not used to train an artificial intelligence model. Nobody consults it, except at your request to help you with a problem, or if the law requires it.

How we protect this data

All exchanges with Google and with your dashboard go through an encrypted connection (HTTPS).
The authorisation is stored on our server in France (OVH), in a folder closed to any access from the internet, accessible only to the program that adds your appointments and to the service administrator.
Your dashboard opens through a personal link that cannot be guessed; connecting one dashboard gives no access to any other.

Retention and deletion

The authorisation and the appointment identifiers are kept for as long as the connection is active.
You can disconnect at any time in your dashboard, under “My Google Calendar”: we immediately ask Google to revoke the authorisation, and we delete it from our server together with the appointment identifiers. Appointments already added remain in your calendar, where you can delete them.
You can also remove access from your Google account, under “Security”: the authorisation then no longer works and we delete it on request. On simple request to contact@opcard.fr, we delete this data within 30 days. In any case, it is deleted with your dashboard.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data (summary)

Use. If you connect your Google Calendar (scope calendar.events.owned), Opcard only creates, updates and deletes the appointments you record in your Opcard CRM, in your primary calendar. We only act on events created by our app; we do not read any other event or any other Google data. We send Google the date, time, contact name, company, phone, e-mail, message and your note for each appointment. We store the refresh token, the IDs of the events we created and your chosen color. Google user data is never sold, shared with third parties, used for advertising or used to train AI models.

Protection. All traffic is encrypted (HTTPS). Tokens are stored on our server in France (OVH) in a directory that cannot be accessed from the internet, only by the program that writes your appointments and by the service administrator.

Retention and deletion. Data is kept only while the connection is active. When you disconnect in your dashboard, we revoke the token at Google and delete it, together with the event IDs, from our server. You can also revoke access in your Google Account security settings, or ask contact@opcard.fr to delete this data within 30 days.

Opcard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Wallet, if you add your card to it

From your dashboard, on Android, the “Add to Google Wallet” button sends Google what already appears on your public card (first and last name, company, job title, numbers, email, logo, link and QR code of the card), so that it can be displayed in your Google Wallet app. We do not receive any data from your Google account. You can remove the card at any time from your Google Wallet app.

Recipients

Your data is processed by Agence 213 and by its technical service providers: OVH (hosting, France), Tally (order form), Stripe (online payment) and Indy (invoicing). Stripe may process data outside the European Union, with the safeguards provided for by the GDPR. If you connect your Google Calendar, the appointments concerned are also sent to Google; if you enable notifications, they go through your phone’s notification service (Google or Apple). These two services may process data outside the European Union. Your data is neither sold nor transferred.

Retention period

Card, dashboard, CRM, statistics and referrals: for the whole paid period. If the card is not renewed, it is taken offline, but everything is kept for 3 years from the end of validity, so that the customer can reactivate it and recover their contacts; at the end of these 3 years without renewal, this data is deleted. The customer can download their contacts from their dashboard at any time, or ask us to delete everything sooner. Invoices: 10 years (accounting obligation). Requests sent through the contact form that have not led to anything: 12 months at most. Backup copies: 12 months at most. Photos sent by visitors to a “venue” card: 12 months at most, then deleted automatically. A venue’s subscriber list: for as long as the person does not unsubscribe, and at most for as long as the venue card is kept.

Cookies

This site does not set any audience measurement or advertising cookies. The order and payment pages may use the cookies that are strictly necessary for them to work.

Your rights

You have the right of access, rectification, erasure, restriction and objection. To exercise these rights: contact@opcard.fr or by post to the address above. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).